@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/plan/diff.js

@@ -1,21 +1,27 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
-import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, ownerMailboxRecorded, ownerMailboxes, } from '../org.js';
+import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, ownerMailboxRecorded, ownerMailboxes, ownsServices, } from '../org.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, chatCallsApplied, chatHasUpstreams, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_MAIL_TOKEN_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleMailTokenDrift, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { chatInternalNames, chatUpstreams } from './chat-matrix.js';
+import { planCompanyBackups } from './company-backups.js';
+import { onPlatformNetwork } from './destinations.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
 import { planEdgeReservedLabels, planEntryEdgeKeys } from './entry-edge-key.js';
 import { planFilesKeys } from './entry-files-key.js';
 import { hasWildcardGate, planGates } from './gates.js';
-import { appHostname, entryHostnames, tunnelDnsHostnames, tunnelDomainList } from './hostnames.js';
+import { appHostname, tunnelDnsHostnames } from './hostnames.js';
 import { lockedHostnames } from './locked-hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
+import { hasAdoptedResources, networkMoveNeeded, planNetworkMove } from './network-move.js';
+import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, planOwnSfu, } from './own-diff.js';
+import { ownDnsHostnames } from './own-dns.js';
+import { ownHostnames } from './own-hostnames.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
-import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec } from './proxy-labels.js';
+import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryRoutes, entryRoutesMarker, } from './proxy-labels.js';
 import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, signInDomainBlockedText, signInOrgDomain, } from './sign-in-org.js';
 import { withStepSystem } from './step-system.js';
 import { planWorkers } from './worker.js';
@@ -56,6 +62,10 @@ function resourceKey(system, kind, key) {
 function madeByFoundry(org, r, recordedIds, recordedValues, platformNames) {
     if (PROVIDER_KINDS[r.system]?.includes(r.kind) && recordedValues.has(r.key))
         return true;
+    // The reader maps an applied own step's app onto its marker (`coolify:own-<service>:<org.id>`); only this org's id is its own.
+    if (r.system === 'coolify' && OWN_MARKER_KINDS.has(r.kind) && r.key === org.id) {
+        return Boolean(recordedIds[`coolify:${r.kind}:${org.id}`]);
+    }
     if (r.system === 'coolify') {
         if (r.kind === 'environment')
             return true;
@@ -78,6 +88,11 @@ function madeByFoundry(org, r, recordedIds, recordedValues, platformNames) {
     if (type === 'CNAME' && content.endsWith('.cfargotunnel.com') && tunnelHostnames.includes(name)) {
         return true;
     }
+    if (type === 'CNAME' &&
+        content.endsWith('.cfargotunnel.com') &&
+        ownDnsHostnames(recordedIds).includes(name)) {
+        return true;
+    }
     const mailDomain = recordedIds[MAIL_DOMAIN_SCOPE_KEY]?.toLowerCase();
     if (!mailDomain)
         return false;
@@ -86,6 +101,14 @@ function madeByFoundry(org, r, recordedIds, recordedValues, platformNames) {
     }
     return name === `_dmarc.${mailDomain}` || name.endsWith(`._domainkey.${mailDomain}`);
 }
+const OWN_MARKER_KINDS = new Set([
+    'own-auth',
+    'own-mail',
+    'own-files',
+    'own-files-r2',
+    'own-jobs',
+    'own-sfu',
+]);
 /** The kinds a provider lists a resource under before a recorded `system:kind:key` maps it to foundry's own. */
 const PROVIDER_KINDS = {
     coolify: ['application', 'database'],
@@ -163,11 +186,22 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const byKey = new Map(live.map((r) => [resourceKey(r.system, r.kind, r.key), r]));
     const claimed = new Set();
     const plannedSteps = [];
-    // The platform's own org: its domain is the platform apex (the same fact
-    // #491 reads for mail). It signs in on the shared instance's own host, so
-    // `issuer.usesDomain` never moves it.
-    const isPlatformOrg = isPlatformOwnOrg(org, platformReadiness.platformOwnerOrgId);
-    const issuer = planIssuer(org, byKey, claimed, platformReadiness.authReady, isPlatformOrg);
+    // An own org's sign-in comes before every step that signs in through it.
+    const ownAuth = planOwnAuth({
+        org,
+        recordedIds,
+        readiness: platformReadiness,
+        ownServices: options.ownServices ?? false,
+        zone: org.domain ? zoneReadiness(org.domain, byKey) : null,
+        oikosZoneReady: options.oikosZoneReady ?? false,
+        mailKeyHeld: options.ownMailKeyHeld ?? false,
+        mailKeyMintable: options.ownMailKeyMintable ?? false,
+    });
+    if (ownAuth.step)
+        plannedSteps.push(ownAuth.step);
+    // An own org's ZITADEL is the company's own instance: nothing that needs it plans before it exists.
+    const ownSignInPending = ownsServices(org) && !ownAuthApplied(org, recordedIds);
+    const issuer = planIssuer(org, byKey, claimed, platformReadiness.authReady);
     if (issuer.step)
         plannedSteps.push(issuer.step);
     // Before the domain and the owners: no invite runs on an org still open to registration.
@@ -182,12 +216,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // #267: after the ZITADEL org step, before any app's own issuer
     // application. Apps created later in this run are not in the binding yet;
     // the next run replans this step and repoints them.
-    const loginHost = planLoginHost(org, recordedIds, platformReadiness.authReady, issuer.step !== null, options.loginHostBindings ?? false, 
-    // #488: `agoraHost.issuer` is the shared ZITADEL instance's own issuer
-    // URL (`https://<platform.auth.hostname>`), the same value every org's
-    // sign-in already reads through `planOwners` above -- no separate port
-    // or plumbing needed to know the platform's own auth hostname.
-    platformAuthHostnameFrom('error' in agoraHost ? null : agoraHost.issuer), isPlatformOrg);
+    const loginHost = planLoginHost(org, recordedIds, platformReadiness.authReady, issuer.step !== null, options.loginHostBindings ?? false);
     if (loginHost.step)
         plannedSteps.push(loginHost.step);
     // #444a: the org's one shared Postgres server and its fixed schema
@@ -199,6 +228,10 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // is pushed just below, before mail.
     const zone = planZone(org, byKey, claimed);
     const zoneWaiting = zone.blocked !== null;
+    // A company without a domain has no zone of its own: it waits for the `oikos.host` zone at the platform's edge.
+    const ownZoneActive = org.domain
+        ? zone.step === null && !zoneWaiting
+        : (options.oikosZoneReady ?? false);
     const zoneBlocked = [];
     // #555: steps that write DNS records, which go through edge.
     const dnsBlocked = [];
@@ -213,7 +246,20 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     else if (zone.step) {
         plannedSteps.push(zone.step);
     }
-    const mail = planMail(org, byKey, claimed, recordedIds, platformReadiness.mailHost, platformReadiness.platformApex, platformReadiness.platformLettermintProjectId);
+    const ownMail = planOwnMail({
+        org,
+        recordedIds,
+        readiness: platformReadiness,
+        ownServices: options.ownServices ?? false,
+        mailRelayApplied: options.mailRelayApplied ?? false,
+        zoneActive: ownZoneActive,
+        ...(options.ownMailSmtpPort !== undefined ? { smtpPort: options.ownMailSmtpPort } : {}),
+    });
+    if (ownMail.step)
+        plannedSteps.push(ownMail.step);
+    const mail = planMail(org, byKey, claimed, recordedIds, platformReadiness.mailHost, platformReadiness.platformApex, platformReadiness.platformLettermintProjectId, options.mailRelayRoute === false
+        ? `the mail relay has no route for ${ownHostnames(org).mailDomain} yet: apply the platform`
+        : undefined);
     // #238: own-domain mail publishes DNS records into the zone, so it waits for
     // an active zone -- blocked, not planned (rule 2).
     if (mail.step && zoneWaiting && org.mail.usesDomain && org.domain) {
@@ -232,12 +278,25 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const mailCopy = planMailCopy(org, byKey, recordedIds);
     if (mailCopy)
         plannedSteps.push(mailCopy);
+    const versionPin = org.versionPin;
     const chat = planChat(org, byKey, claimed, recordedIds, agoraHost, issuer.step !== null);
     if (chat.step)
         plannedSteps.push(chat.step);
-    const calls = planCalls(org, byKey, claimed, platformReadiness.callsReady);
+    const calls = planCalls(org, byKey, claimed, platformReadiness.callsReady, versionPin?.calls);
     if (calls.step)
         plannedSteps.push(calls.step);
+    // An own org's media server, before the calls service that reads its addresses.
+    const ownSfu = planOwnSfu({
+        org,
+        recordedIds,
+        ownServices: options.ownServices ?? false,
+        zoneActive: ownZoneActive,
+        readiness: platformReadiness,
+        sfuPortsOpen: options.sfuPortsOpen ?? false,
+        keysHeld: options.ownSfuKeysHeld ?? false,
+    });
+    if (ownSfu.step)
+        plannedSteps.push(ownSfu.step);
     // Right after the Matrix stack (#145): its own executor
     // (`executor.ts`'s `coolifyCallsService`) reads the Synapse/MAS addresses
     // and MAS client credentials `coolifyCalls` just recorded, the same
@@ -262,14 +321,35 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const versionChanges = [];
     if (org.calls.enabled && !calls.blocked) {
         const callsAppLive = Boolean(byKey.get(resourceKey('coolify', 'calls', org.id)));
-        const synapseChange = versionNotAppliedLine('synapse', callsAppLive, recordedIds[CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY], VERSIONS.synapse);
+        const synapseChange = versionNotAppliedLine('synapse', callsAppLive, recordedIds[CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY], versionPin?.calls ?? VERSIONS.synapse);
         if (synapseChange)
             versionChanges.push(synapseChange);
         const masChange = versionNotAppliedLine('mas', callsAppLive, recordedIds[CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY], VERSIONS.mas);
         if (masChange)
             versionChanges.push(masChange);
     }
-    const filesOrganisation = planFilesOrganisation(org, byKey, claimed, platformReadiness.filesReady, platformReadiness.missingKeys.files, platformReadiness.noKeyReader);
+    // An own org's files host, before its organisation on it.
+    const ownFiles = planOwnFiles({
+        org,
+        recordedIds,
+        readiness: platformReadiness,
+        ownServices: options.ownServices ?? false,
+        filesDeps: options.ownFilesDeps ?? { keys: false, bucket: false },
+    });
+    if (ownFiles.step)
+        plannedSteps.push(ownFiles.step);
+    // After the host is applied: its storage key is delivered to the running host.
+    const ownFilesR2 = options.ownFilesR2Ports
+        ? planOwnFilesR2({
+            org,
+            recordedIds,
+            ownServices: options.ownServices ?? false,
+            ports: options.ownFilesR2Ports,
+        })
+        : { step: null, blocked: null };
+    if (ownFilesR2.step)
+        plannedSteps.push(ownFilesR2.step);
+    const filesOrganisation = planFilesOrganisation(org, byKey, claimed, platformReadiness.filesReady, platformReadiness.missingKeys.files, platformReadiness.noKeyReader, ownsServices(org) && !recordedIds[`coolify:own-files:${org.id}`]);
     if (filesOrganisation.step)
         plannedSteps.push(filesOrganisation.step);
     const aiOrganisation = planAiOrganisation(org, byKey, claimed, platformReadiness.aiReady, platformReadiness.missingKeys.ai, platformReadiness.noKeyReader);
@@ -360,7 +440,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const edgeReservedLabels = planEdgeReservedLabels(org, recordedIds, platformReadiness, options.platformHostnames ?? []);
     if (edgeReservedLabels.step)
         plannedSteps.push(edgeReservedLabels.step);
-    const tunnel = planTunnel(org, byKey, claimed, recordedIds, isPlatformOrg, platformReadiness.platformApex);
+    const tunnel = planTunnel(org, byKey, claimed, recordedIds, platformReadiness.platformApex);
     // #238: a tunnel that is being provisioned waits for an active zone; parking
     // one never does.
     // #555: provisioning writes the tunnel config, the zone lookup and DNS; a
@@ -411,7 +491,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const agoraGuarded = guardApp(agoraClient);
     if (agoraGuarded)
         plannedSteps.push(agoraGuarded);
-    const agora = planAgora(org, byKey, claimed, recordedIds, agoraHost);
+    const agora = planAgora(org, byKey, claimed, recordedIds, agoraHost, {
+        servesDiscovery: options.loginHostServesDiscovery ?? false,
+    });
     if (agora.step)
         plannedSteps.push(agora.step);
     // #161 (Boule part): every org's own Boule -- always on, no toggle, the same
@@ -433,10 +515,22 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const bouleBroker = planBouleBrokerEntry(org, recordedIds, plannedSteps, options.broker ?? false);
     if (bouleBroker.step)
         plannedSteps.push(bouleBroker.step);
+    // An own org's scheduler, before its registration below.
+    const ownJobs = planOwnJobs({
+        org,
+        recordedIds,
+        readiness: platformReadiness,
+        ownServices: options.ownServices ?? false,
+        tokenHeld: options.ownJobsTokenHeld ?? false,
+    });
+    if (ownJobs.step)
+        plannedSteps.push(ownJobs.step);
     // #173: register the org's own app with the platform's jobs scheduler.
     // After Agora, so a failing registration can never stop Agora from
     // provisioning (`runSteps` stops at the first failing step).
-    const jobsRegistration = planJobsRegistration(org, recordedIds, jobsAvailable || platformReadiness.jobsReady, platformReadiness.missingKeys.jobs, platformReadiness.noKeyReader, platformReadiness.jobsUrlMissing ?? false);
+    const jobsRegistration = planJobsRegistration(org, recordedIds, 
+    // An own org never registers with the shared scheduler the host supplies.
+    (jobsAvailable && !ownsServices(org)) || platformReadiness.jobsReady, platformReadiness.missingKeys.jobs, platformReadiness.noKeyReader, platformReadiness.jobsUrlMissing ?? false);
     if (jobsRegistration.step)
         plannedSteps.push(jobsRegistration.step);
     // F8 (#318), after Agora and Boule, not right after the zone: a route
@@ -476,6 +570,11 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const recordedValues = new Set(Object.values(recordedIds));
     for (const own of ['', org.id, org.slug, org.domain ?? ''])
         recordedValues.delete(own);
+    // Archon's and the Access provider's project and client live in the owner company's ZITADEL.
+    if (platformReadiness.platformOwnerOrgId === org.id) {
+        for (const id of platformReadiness.platformZitadelIds ?? [])
+            recordedValues.add(id);
+    }
     const platformNames = new Set([...(options.platformHostnames ?? []), platformReadiness.mailHost?.mailHost ?? ''].map((h) => h.toLowerCase()));
     platformNames.delete('');
     const unmanaged = live
@@ -489,6 +588,8 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // item list, so it rides along with the unmanaged items.
     if (agora.blocked)
         unmanaged.push({ description: agora.blocked, key: 'coolify:agora' });
+    if (agora.issuerNote)
+        unmanaged.push({ description: agora.issuerNote, key: 'coolify:agora' });
     if (boule.blocked)
         unmanaged.push({ description: boule.blocked, key: 'coolify:boule' });
     if (boule.mailBlocked) {
@@ -503,6 +604,22 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...edgeWorkers.blocked);
     unmanaged.push(...entryEdgeKeys.blocked);
     unmanaged.push(...edgeReservedLabels.blocked);
+    if (ownAuth.blocked)
+        unmanaged.push({ description: ownAuth.blocked, key: OWN_AUTH_BLOCKED_KEY });
+    if (ownJobs.blocked)
+        unmanaged.push({ description: ownJobs.blocked, key: OWN_JOBS_BLOCKED_KEY });
+    if (ownMail.blocked)
+        unmanaged.push({ description: ownMail.blocked, key: OWN_MAIL_BLOCKED_KEY });
+    if (ownSfu.blocked)
+        unmanaged.push({ description: ownSfu.blocked, key: OWN_SFU_BLOCKED_KEY });
+    if (ownSfu.firewall)
+        unmanaged.push({ description: ownSfu.firewall, key: OWN_SFU_FIREWALL_KEY });
+    if (ownFiles.blocked) {
+        unmanaged.push({ description: ownFiles.blocked, key: OWN_FILES_BLOCKED_KEY });
+    }
+    if (ownFilesR2.blocked) {
+        unmanaged.push({ description: ownFilesR2.blocked, key: OWN_FILES_R2_BLOCKED_KEY });
+    }
     // Same for a jobs registration that cannot run (no scheduler wired) or must
     // not run again (minted, never delivered).
     if (jobsRegistration.blocked) {
@@ -513,9 +630,20 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // `platformReadiness` instead of a host-supplied port. Each is reported at
     // most once even though a dependent step (owner, calls-service, storage,
     // budget, key) would otherwise also have nothing to act on.
-    if (issuer.blocked)
-        unmanaged.push({ description: issuer.blocked, key: 'zitadel:issuer' });
-    unmanaged.push(...owners.blocked);
+    if (ownSignInPending) {
+        // The sign-in step's own reason, when it has one, already says why the rest waits.
+        if (!ownAuth.blocked) {
+            unmanaged.push({
+                description: `${org.slug}'s ZITADEL steps are blocked, not planned: its own sign-in service is not applied yet`,
+                key: 'coolify:own-auth',
+            });
+        }
+    }
+    else {
+        if (issuer.blocked)
+            unmanaged.push({ description: issuer.blocked, key: 'zitadel:issuer' });
+        unmanaged.push(...owners.blocked);
+    }
     const domainBlocked = orgDomainBlocked(org, recordedIds);
     if (domainBlocked)
         unmanaged.push(domainBlocked);
@@ -566,14 +694,50 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...app.blocked);
     unmanaged.push(...brokerEntries.blocked);
     unmanaged.push(...bouleBroker.blocked);
+    // F6: last, so every database step above runs before the backup of its database.
+    const backups = planCompanyBackups(org, recordedIds, options.backupStorageUuid);
+    plannedSteps.push(...backups.steps);
+    unmanaged.push(...backups.blocked);
+    // A company built on the shared network plans the move and nothing else: its other steps would act on
+    // resources the move deletes.
+    // The platform's own company stays on the platform network, so it is never moved.
+    const ownerCompany = onPlatformNetwork(isPlatformOwnOrg(org, platformReadiness.platformOwnerOrgId));
+    const networkMove = ownerCompany ? null : planNetworkMove(org, recordedIds);
+    if (!ownerCompany && networkMoveNeeded(recordedIds) && hasAdoptedResources(recordedIds)) {
+        unmanaged.push({
+            description: `${org.slug}'s adopted app and database stay on the shared Docker network: foundry did not create them and does not move them`,
+            key: 'coolify:network',
+        });
+    }
     return {
         orgId: org.id,
-        plannedSteps: plannedSteps.map(withStepSystem),
+        plannedSteps: (networkMove
+            ? [networkMove]
+            : ownSignInPending
+                ? plannedSteps.filter((s) => !NEEDS_OWN_ZITADEL.has(`${s.action.system}:${s.action.kind}`))
+                : plannedSteps).map(withStepSystem),
         unmanaged,
         versionChanges,
         orgPostgres,
     };
 }
+/** Steps that run against the org's own ZITADEL instance (its projects, apps and broker entries). */
+const NEEDS_OWN_ZITADEL = new Set([
+    'zitadel:issuer',
+    'zitadel:registration-closed',
+    'zitadel:domain',
+    'zitadel:owner',
+    'zitadel:app',
+    'zitadel:customers',
+    'zitadel:id-token-userinfo',
+    'zitadel:login-host',
+    'coolify:chat',
+    'coolify:calls-service',
+    'coolify:calls-chat',
+    'coolify:broker-entry',
+    'coolify:boule-broker-entry',
+    'files:organisation',
+]);
 /**
  * #553: a plain ZITADEL app provision (not a `recreate`) is planned only when
  * the live listing lacks the app by name. If an app id is recorded for it,
@@ -643,7 +807,7 @@ function edgeBlockedItem(org, what, key, reason) {
  * already exists live is unaffected: its own domain-move logic runs
  * regardless, since that never re-provisions the ZITADEL org itself.
  */
-function planIssuer(org, byKey, claimed, authReady, isPlatformOrg = false) {
+function planIssuer(org, byKey, claimed, authReady) {
     const key = resourceKey('zitadel', 'issuer', org.id);
     const live = byKey.get(key);
     const desiredUsesDomain = org.issuer.usesDomain;
@@ -681,10 +845,8 @@ function planIssuer(org, byKey, claimed, authReady, isPlatformOrg = false) {
         Boolean(org.domain) &&
         liveHost !== null &&
         liveHost !== loginHostnameFor(org);
-    // The platform's own org already signs in on the shared host: no move. A
-    // live issuer that does not say is not read as a different one either.
-    if (isPlatformOrg ||
-        live.config.usesDomain === undefined ||
+    // A live issuer that does not say is not read as a different one either.
+    if (live.config.usesDomain === undefined ||
         (Boolean(live.config.usesDomain) === desiredUsesDomain && !domainMoved)) {
         return { step: null, blocked: null };
     }
@@ -867,27 +1029,10 @@ function planOwners(org, recordedIds, authReady, authIssuer, ownerInviteMail, re
     });
     return { steps, blocked };
 }
-/**
- * #488: the bare hostname out of an issuer URL (`https://<hostname>`, the
- * only shape {@link agoraHostValuesFromPlatform} or a host-supplied
- * `AgoraHostPort` ever hands back), or `null` when there is no issuer to
- * read one from. What {@link loginHostnameFor} compares the org's own
- * computed `auth.<domain>` against, so the platform's own org never plans
- * its login host equal to the shared ZITADEL instance's own.
- */
+/** True when `org` is the platform's owner company. */
 export function isPlatformOwnOrg(org, platformOwnerOrgId) {
     return Boolean(platformOwnerOrgId && org.id === platformOwnerOrgId);
 }
-function platformAuthHostnameFrom(issuer) {
-    if (!issuer)
-        return null;
-    try {
-        return new URL(issuer).hostname;
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * #267: the org's own company login host (`login-host.ts`'s
  * `loginHostnameFor`) -- `auth.<domain>` once the org has one,
@@ -924,51 +1069,24 @@ function platformAuthHostnameFrom(issuer) {
  * platform's own domain, never plans the shared ZITADEL instance's own login
  * host as its own -- `auth.companyincluded.com` colliding with itself.
  */
-function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired, platformAuthHostname, isPlatformOrg) {
+function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired) {
     const none = { step: null, blocked: null };
+    // An own org's instance has no shared login host to bind: its issuer is the sign-in service's own.
+    if (ownsServices(org))
+        return none;
     const key = resourceKey('zitadel', 'login-host', org.id);
-    // The platform's own org signs in on the shared instance's host whatever
-    // `issuer.usesDomain` says (turning it on would move the issuer).
-    // Before that host is known, plan nothing: a guessed host would delete the
-    // working one, and a normal step would trust a domain `destroy` later deletes.
-    if (isPlatformOrg && platformAuthHostname === null) {
-        return {
-            step: null,
-            blocked: `${org.slug}'s login host is waiting for the platform auth host`,
-        };
-    }
-    const sharedInstanceHost = isPlatformOrg && platformAuthHostname !== null;
-    const host = sharedInstanceHost ? platformAuthHostname : loginHostnameFor(org);
-    // #488: the guard in `loginHostnameFor` fired -- the org's own domain host
-    // would have been the platform's shared ZITADEL instance host.
-    if (sharedInstanceHost) {
-        // The host is the shared instance's own: nothing to trust or bind, and an
-        // org with no recorded host already signs in there. Only an org recorded
-        // on another host (the old `<slug>-auth.oikos.host`) plans one step, to
-        // move its apps over and remove the old host; then it plans nothing.
-        const recordedHost = recordedIds[key];
-        const moving = recordedHost !== undefined && recordedHost !== host;
-        const removalOwed = pendingRemovalHosts(recordedIds).length > 0;
-        if (!authReady || !(moving || removalOwed))
-            return none;
-        // The same gates as the normal branch: the executor's shared step also
-        // needs the binding port and the ZITADEL org.
-        const waiting = loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned);
-        return waiting ?? stepFor(true);
-    }
-    function stepFor(shared) {
+    const host = loginHostnameFor(org);
+    function stepFor() {
         return {
             step: {
                 action: {
                     system: 'zitadel',
                     kind: 'login-host',
                     key: org.id,
-                    desired: shared ? { host, shared: true } : { host },
+                    desired: { host },
                 },
                 step: {
-                    description: shared
-                        ? `move ${org.slug}'s apps onto the platform's own sign-in host ${host}`
-                        : `set ${org.slug}'s login host to ${host}`,
+                    description: `set ${org.slug}'s login host to ${host}`,
                     destroys: false,
                     migrates: false,
                 },
@@ -996,7 +1114,7 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
     // Isolation between orgs rests on zitadel-login's binding, and repointing
     // an app at a host with no binding breaks its sign-in: trust nothing and
     // repoint nothing until the port that writes the binding is wired.
-    return loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned) ?? stepFor(false);
+    return loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned) ?? stepFor();
 }
 /**
  * Every sign-in app this org already has live (web or native, not api) gets
@@ -1126,7 +1244,9 @@ export const JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY = 'jobs_registration_undeli
  */
 function planMail(org, byKey, claimed, recordedIds, mailHost, 
 /** #491 (review round 2): read off `platformReadiness` directly, not off `mailHost` -- see `OrgPlatformReadiness.platformApex`'s own doc comment for why. */
-platformApex, platformLettermintProjectId) {
+platformApex, platformLettermintProjectId, 
+/** Why the MX cannot be published yet: the relay does not route this org's mail domain. */
+relayBlocked) {
     const key = resourceKey('coolify', 'mail', org.id);
     const live = byKey.get(key);
     // `off` means mail is not foundry's concern here (org.ts's MailMode doc);
@@ -1142,7 +1262,14 @@ platformApex, platformLettermintProjectId) {
     if (!mailHost) {
         return {
             step: null,
-            blocked: `${org.slug}'s mail is blocked, not planned: the platform's mail server is off or not yet applied`,
+            blocked: `${org.slug}'s mail is blocked, not planned: its own mail server is not applied yet`,
+            mailboxBlocked: null,
+        };
+    }
+    if (relayBlocked) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s mail is blocked, not planned: ${relayBlocked}`,
             mailboxBlocked: null,
         };
     }
@@ -1490,12 +1617,14 @@ function planChat(org, byKey, claimed, recordedIds, reading, issuerPlanned) {
  * `sfu:livekit` step is declared. Parking, and an already-provisioned stack,
  * are unaffected.
  */
-function planCalls(org, byKey, claimed, callsReady) {
+function planCalls(org, byKey, claimed, callsReady, synapseTag) {
     const key = resourceKey('coolify', 'calls', org.id);
     if (org.calls.enabled && !byKey.get(key) && !callsReady) {
         return {
             step: null,
-            blocked: `${org.slug}'s calls Matrix stack is blocked, not planned: the platform's shared calls SFU is off`,
+            blocked: ownsServices(org)
+                ? `${org.slug}'s calls Matrix stack is blocked, not planned: its own media server (coolify:own-sfu) is not applied yet`
+                : `${org.slug}'s calls Matrix stack is blocked, not planned: the platform owner's calls SFU (the platform's) is off`,
         };
     }
     // #248: the two images this stack's own apply would run, checked the same
@@ -1503,7 +1632,7 @@ function planCalls(org, byKey, claimed, callsReady) {
     // own tag -- a re-apply of the same declaration must not silently run a
     // different version with no diff shown anywhere.
     if (org.calls.enabled && !byKey.get(key)) {
-        const synapseBlocked = floatingTagBlocked('Synapse', VERSIONS.synapse, 'v1.161.0');
+        const synapseBlocked = floatingTagBlocked('Synapse', synapseTag ?? VERSIONS.synapse, 'v1.161.0');
         if (synapseBlocked) {
             return {
                 step: null,
@@ -1518,10 +1647,12 @@ function planCalls(org, byKey, claimed, callsReady) {
             };
         }
     }
-    return {
-        step: planHostingToggle('coolify', 'calls', org.calls.enabled, org, byKey, claimed, () => `provision ${org.slug}'s calls Matrix stack (Synapse + matrix-authentication-service)`, () => `park ${org.slug}'s calls Matrix stack (stops serving; data is retained, not deleted -- #7 corrections 1)`),
-        blocked: null,
-    };
+    const toggle = planHostingToggle('coolify', 'calls', org.calls.enabled, org, byKey, claimed, () => `provision ${org.slug}'s calls Matrix stack (Synapse + matrix-authentication-service)`, () => `park ${org.slug}'s calls Matrix stack (stops serving; data is retained, not deleted -- #7 corrections 1)`);
+    // A held Synapse tag rides in the provisioning step; a parking step carries none.
+    if (toggle && synapseTag && toggle.action.desired.enabled === true) {
+        toggle.action.desired = { ...toggle.action.desired, synapseTag };
+    }
+    return { step: toggle, blocked: null };
 }
 /**
  * The org's own calls service (#145, part 2 of #128) -- `wtfalch/calls`'s
@@ -1544,6 +1675,13 @@ function planCallsService(org, byKey, claimed, callsReady, recordedIds, callsBlo
     if (org.calls.enabled && !byKey.get(key) && !callsReady) {
         return { step: null, blocked: null };
     }
+    // An own org's service names its own media server, so it waits for it even when already provisioned.
+    if (org.calls.enabled && ownsServices(org) && !callsReady) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s calls service is blocked, not planned: its own media server (coolify:own-sfu) is not applied yet`,
+        };
+    }
     // The introspection secret is shown once. One minted but never written to
     // the app is lost, so this reports it and mints no second (platform rule 1).
     const undelivered = recordedIds[CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY];
@@ -1771,13 +1909,21 @@ function notReadyReason(service, keyName, missingKeyRef, noKeyReader) {
  * Files organisation already exists -- the old origin is left allowed
  * rather than silently dropped.
  */
-function planFilesOrganisation(org, byKey, claimed, filesReady, missingKeyRef, noKeyReader = false) {
+function planFilesOrganisation(org, byKey, claimed, filesReady, missingKeyRef, noKeyReader = false, 
+/** An own org whose files host (`coolify:own-files:<org.id>`) is not recorded yet. */
+ownFilesPending = false) {
     const key = resourceKey('files', 'organisation', org.id);
     const live = byKey.get(key);
     if (live) {
         claimed.add(key);
         return { step: null, blocked: null };
     }
+    if (ownFilesPending) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s Files organisation is blocked, not planned: its own files host is not applied yet`,
+        };
+    }
     if (!filesReady) {
         return {
             step: null,
@@ -2150,14 +2296,32 @@ function planAgoraClient(org, byKey, claimed) {
  * message naming each missing value, which `computePlanDetail` lists with the
  * plan's non-step items, so every other step still applies.
  */
-function planAgora(org, byKey, claimed, recordedIds, reading) {
+function planAgora(org, byKey, claimed, recordedIds, reading, issuerSwitch) {
     const key = resourceKey('coolify', 'agora', org.id);
     const live = byKey.get(key);
     if (live)
         claimed.add(key);
+    const ownSignIn = ownsServices(org);
+    if (ownSignIn && !ownAuthApplied(org, recordedIds)) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s Agora is blocked, not planned: its own sign-in service is not applied yet`,
+            issuerNote: null,
+        };
+    }
+    // The files host records its internal URL only while it applies, and Agora's
+    // env takes its files upstream from it: planned in the same pass, the first
+    // deploy would start without one.
+    if (ownSignIn && !recordedIds[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY]) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s Agora is blocked, not planned: its own files host is not applied yet`,
+            issuerNote: null,
+        };
+    }
     const error = 'error' in reading ? reading.error : null;
-    const host = withRecordedMessagingProject('error' in reading ? NO_AGORA_HOST_VALUES : reading, recordedIds);
-    const missing = agoraHostMissing(host);
+    const platformHost = withRecordedMessagingProject('error' in reading ? NO_AGORA_HOST_VALUES : reading, recordedIds);
+    const missing = agoraHostMissing(platformHost);
     if (missing.length > 0) {
         // A fixed text, never the port's own message: this line is part of the
         // stale-plan comparison, and an error that varies per call would refuse
@@ -2166,8 +2330,41 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
         return {
             step: null,
             blocked: `${org.slug}'s Agora is blocked, not planned: the host supplies no ${missing.join(', ')}${why}`,
+            issuerNote: null,
         };
     }
+    // Agora signs in at the company's own login host, and refuses any issuer off
+    // its own address's domain. Only this value changes: the calls token env,
+    // chat and Boule keep reading the platform issuer from `reading`, and Agora
+    // always plans. The company host is written only once the login host is
+    // applied with Agora's client AND a live read said it serves discovery as
+    // that issuer. An Agora already on the company host keeps it while the host
+    // stays applied: a later failing read never flips it back (no oscillation).
+    let host = platformHost;
+    let issuerNote = null;
+    const choice = agoraIssuerHostFor(org);
+    if (choice.mismatch) {
+        issuerNote = `${org.slug}'s Agora cannot sign in: its login host ${loginHostnameFor(org)} is not on its Agora address ${agoraHostnameFor(org)}; the login host must be on the org's domain`;
+    }
+    else if (choice.host) {
+        const loginHost = choice.host;
+        const target = `https://${loginHost}`;
+        const applied = loginHostServesAgora(loginHost, org, recordedIds);
+        if (applied && (liveAgoraIssuer(live) === target || issuerSwitch.servesDiscovery)) {
+            host = { ...platformHost, issuer: target };
+        }
+        else if (ownSignIn) {
+            // No platform issuer to fall back on: Agora waits for the company's own.
+            return {
+                step: null,
+                blocked: `${org.slug}'s Agora is blocked, not planned: ${target} does not answer OIDC discovery yet`,
+                issuerNote: null,
+            };
+        }
+        else {
+            issuerNote = `${org.slug}'s Agora keeps the platform issuer; the switch to ${target} is blocked, not planned, until ${loginHost} is applied with Agora's client and answers OIDC discovery`;
+        }
+    }
     // The executor writes exactly these host values, so what the plan showed
     // is what gets applied; the ids only the apply itself records are read at
     // run time.
@@ -2188,6 +2385,7 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
                 },
             },
             blocked: null,
+            issuerNote,
         };
     }
     const liveEnv = (live.config.env ?? {});
@@ -2215,8 +2413,9 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
     // actually serving this exact `env`; while it disagrees, the step stays
     // planned no matter what Coolify's env store already shows.
     const activated = recordedIds[AGORA_ACTIVATED_ENV_SCOPE_KEY] === agoraEnvRevision(env);
-    if (drift.length === 0 && activated && !portDrift)
-        return { step: null, blocked: null };
+    if (drift.length === 0 && activated && !portDrift) {
+        return { step: null, blocked: null, issuerNote };
+    }
     const reasons = [
         ...(drift.length > 0 ? [`${drift.join(', ')} missing or different`] : []),
         ...(portDrift ? ["ports_exposes wrong -- Traefik can't reach it"] : []),
@@ -2233,8 +2432,22 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
             },
         },
         blocked: null,
+        issuerNote,
     };
 }
+/** The issuer a live Agora's `AGORA_CONFIG` names, or null when it has none or is not JSON. */
+function liveAgoraIssuer(live) {
+    const raw = (live?.config.env ?? {}).AGORA_CONFIG;
+    if (raw === undefined)
+        return null;
+    try {
+        const issuer = JSON.parse(raw)?.issuer;
+        return typeof issuer === 'string' ? issuer : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * #161 (Boule part): every org gets one fixed ZITADEL web client named
  * `boule`, so its Boule (https://github.com/wtfalch/boule) can sign anyone in.
@@ -2486,7 +2699,6 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
     const blockedKey = (rest) => entryKey === APP_ENTRY_KEY ? `coolify:app:${rest}` : `coolify:app:${entryKey}:${rest}`;
     const { marker: wantedEnv, unresolved, unresolvedSecrets, } = entry
         ? resolveAppEnv(org, entry, recordedIds, {
-            platformMailKey: readiness.mailKeyHeld === true,
             sharedSecret: readiness.canHoldSecrets === true,
         })
         : { marker: {}, unresolved: [], unresolvedSecrets: [] };
@@ -2502,9 +2714,7 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
             .concat(
         // Never a value: the ref of the missing key, or what the host lacks.
         unresolvedSecrets.map(([name, source]) => ({
-            description: `${org.slug}'s ${label} env ${name} is blocked, not planned: ${source === 'platformMailKey'
-                ? `the platform's Lettermint key is not held yet (held-key ref ${PLATFORM_AUTH_BROKER_MAIL_KEY_REF})`
-                : `its source ${source} needs a held-key store that can put, and the host has none`}`,
+            description: `${org.slug}'s ${label} env ${name} is blocked, not planned: ${`its source ${source} needs a held-key store that can put, and the host has none`}`,
             key: blockedKey(`env:${name}`),
         })))
         : [];
@@ -2544,7 +2754,18 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
             key: blockedKey('repo'),
         });
     }
-    const toggled = planHostingToggle('coolify', 'app', entry !== undefined && !noRepo, org, byKey, claimed, () => `provision ${org.slug}'s ${label}`, () => `park ${org.slug}'s ${label} (stops serving; app data is retained, not deleted -- #7 corrections 1)`, stepKey);
+    // A compose file can set `privileged`, host networking or a Docker socket mount, and its labels are
+    // its own. `validateHosting` refuses the build pack on write; an entry stored before that rule is
+    // held here too, and a live app of it is parked like one whose entry was removed.
+    const composeBuilt = entry !== undefined && entry.buildPack === 'dockercompose';
+    if (composeBuilt) {
+        blocked.push({
+            description: `${org.slug}'s ${label} is blocked, not planned: a compose-built app is refused until its compose file is checked`,
+            key: blockedKey('compose'),
+        });
+    }
+    const refused = noRepo || composeBuilt;
+    const toggled = planHostingToggle('coolify', 'app', entry !== undefined && !refused, org, byKey, claimed, () => `provision ${org.slug}'s ${label}`, () => `park ${org.slug}'s ${label} (stops serving; app data is retained, not deleted -- #7 corrections 1)`, stepKey);
     // #447: only the live app's own `git_repository` decides, never the
     // declared entry (a `repo: null` entry can sit over a bespoke app, which is
     // parked as before). Only the `app` key ever held the default app, and an
@@ -2576,7 +2797,7 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
     }
     if (toggled)
         return { step: toggled, blocked };
-    if (!entry || noRepo)
+    if (!entry || refused)
         return { step: null, blocked };
     const live = byKey.get(resourceKey('coolify', 'app', stepKey));
     if (!live)
@@ -2691,15 +2912,14 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
             blocked,
         };
     }
-    // A changed hostname reaches an app that is already live: its domains are
-    // patched and it is redeployed.
-    if (JSON.stringify(tunnelDomainList(entryHostnames(org, entry))) !==
-        JSON.stringify(appliedAppDomains(org, recordedIds, entryKey))) {
+    // No entry carries Coolify `domains`: the company's tunnel routes its names straight to the container.
+    // An app that still holds some (made before that) has them cleared and is redeployed.
+    if (appliedAppDomains(org, recordedIds, entryKey).length > 0) {
         return {
             step: {
                 action,
                 step: {
-                    description: `apply ${org.slug}'s ${label} hostnames and redeploy the app`,
+                    description: `remove ${org.slug}'s ${label} Coolify domains (the tunnel routes it directly) and redeploy the app`,
                     destroys: false,
                     migrates: false,
                 },
@@ -2707,17 +2927,16 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
             blocked,
         };
     }
-    // A `*` entry's proxy labels reach an app that is already live: the label
-    // set is patched and the app redeployed once its hash differs from the one
-    // `coolifyApp` recorded.
+    // A changed hostname, wildcard or port, or a container still open to Traefik: the label set
+    // (`traefik.enable=false`) is patched and the app redeployed once the marker `coolifyApp`
+    // recorded differs from the wanted one.
     const appliedLabels = recordedIds[appLabelsAppliedScopeKey(entryKey)];
-    const labelSpec = entryLabelSpec(org, entry, appliedLabels !== undefined);
-    if (labelSpec && entryLabelHash(labelSpec) !== appliedLabels) {
+    if (entryLabelHash(entryLabelSpec(org, entry)) !== appliedLabels) {
         return {
             step: {
                 action,
                 step: {
-                    description: `apply ${org.slug}'s ${label} proxy labels and redeploy the app`,
+                    description: `apply ${org.slug}'s ${label} routing (hostnames, port, no Traefik route) and redeploy the app`,
                     destroys: false,
                     migrates: false,
                 },
@@ -2783,12 +3002,11 @@ function planApps(org, byKey, claimed, recordedIds, plannedSteps, authIssuer, re
         // The same availability the plan's marker used: the executor records its
         // marker from this, never from its own port, so the two cannot disagree.
         const usesSecrets = org.hosting.entries.some((e) => e.key === key &&
-            Object.values(e.env).some((v) => typeof v !== 'string' && (v.from === 'sharedSecret' || v.from === 'platformMailKey')));
+            Object.values(e.env).some((v) => typeof v !== 'string' && v.from === 'sharedSecret'));
         if (usesSecrets && app.step && app.step.action.desired.enabled !== false) {
             app.step.action.desired = {
                 ...app.step.action.desired,
                 secretSources: {
-                    platformMailKey: readiness.mailKeyHeld === true,
                     sharedSecret: readiness.canHoldSecrets === true,
                 },
             };
@@ -2871,6 +3089,16 @@ function planJobsRegistration(org, recordedIds, jobsAvailable, missingKeyRef = n
     // The host says whether its executor has a scheduler to register with. A
     // fixed text: it is part of the stale-plan comparison.
     if (!jobsAvailable) {
+        if (ownsServices(org)) {
+            return {
+                step: null,
+                blocked: `${org.slug}'s jobs registration is blocked, not planned: ${addressMissing
+                    ? `${org.slug}'s own jobs scheduler has not recorded its internal address yet; apply its own jobs step first`
+                    : missingKeyRef
+                        ? `${org.slug}'s own jobs admin token ${missingKeyRef} is not held yet`
+                        : `${org.slug}'s own jobs scheduler is not applied yet`}`,
+            };
+        }
         return {
             step: null,
             blocked: addressMissing
@@ -2943,11 +3171,13 @@ function sortedNames(names) {
  * domain) plans no per-org tunnel for Agora: `<slug>-agora.oikos.host` rides
  * the shared `*.oikos.host` wildcard tunnel (`scripts/shared-ingress.mjs`).
  */
-function planTunnel(org, byKey, claimed, recordedIds, isPlatformOrg, platformApex) {
+function planTunnel(org, byKey, claimed, recordedIds, platformApex) {
     const desired = (org.hosting.tunnel && org.hosting.usesDomain && Boolean(org.domain)) ||
         (org.site.enabled && Boolean(org.domain)) ||
         (org.calls.enabled && org.calls.usesDomain && Boolean(org.domain)) ||
-        Boolean(org.domain);
+        Boolean(org.domain) ||
+        // A company without a domain still gets a tunnel of its own for an entry at `<slug>.oikos.host`.
+        entryRoutes(org).length > 0;
     const toggled = planHostingToggle('cloudflare', 'tunnel', desired, org, byKey, claimed, () => `provision a Cloudflare tunnel for ${org.slug}'s app`, () => `park ${org.slug}'s Cloudflare tunnel (configuration is retained, not deleted -- #7 corrections 1)`, org.id, 
     // Cloudflare's status, read against what is declared: a park cannot change
     // it, so judging on/off by status alone would never let the plan empty.
@@ -2963,7 +3193,7 @@ function planTunnel(org, byKey, claimed, recordedIds, isPlatformOrg, platformApe
     // #568: the company's own login host is routed by the step, so a first
     // provision carries it too; a park does not. Without a known platform apex
     // the platform's own org cannot be told apart, so none is planned.
-    const loginHost = platformApex ? companyLoginTunnelHost(org, isPlatformOrg) : null;
+    const loginHost = platformApex ? companyLoginTunnelHost(org) : null;
     if (toggled && toggled.action.desired.enabled !== false && loginHost) {
         return {
             ...toggled,
@@ -2995,8 +3225,17 @@ function planTunnel(org, byKey, claimed, recordedIds, isPlatformOrg, platformApe
         org.domain !== null &&
         sortedNames(published.split(',')) !==
             sortedNames(tunnelDnsHostnames(org, org.domain, loginHost));
-    const dnsStale = recordedIds[CLOUDFLARE_TUNNEL_DNS_DOMAIN_SCOPE_KEY] !== org.domain || edgeChanged;
-    if (!connectorMissing && !dnsStale)
+    // The entry names in the platform's oikos.host zone are recorded apart from the company's own zone.
+    const oikosStale = (recordedIds[CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY] ?? '') !==
+        entryOikosHostnames(org).join(',');
+    const dnsStale = (org.domain !== null && recordedIds[CLOUDFLARE_TUNNEL_DNS_DOMAIN_SCOPE_KEY] !== org.domain) ||
+        edgeChanged ||
+        oikosStale;
+    // An entry's hostname goes straight to its container, so a changed port, key or name, or an ingress
+    // written before entries were routed that way, needs the ingress written again. Nothing recorded
+    // equals no routes.
+    const routesStale = (recordedIds[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY] ?? '[]') !== entryRoutesMarker(org);
+    if (!connectorMissing && !dnsStale && !routesStale)
         return null;
     return {
         action: {
@@ -3008,7 +3247,9 @@ function planTunnel(org, byKey, claimed, recordedIds, isPlatformOrg, platformApe
         step: {
             description: connectorMissing
                 ? `run a cloudflared connector for ${org.slug}'s Cloudflare tunnel`
-                : `point ${org.slug}'s hostnames at its Cloudflare tunnel`,
+                : dnsStale
+                    ? `point ${org.slug}'s hostnames at its Cloudflare tunnel`
+                    : `route ${org.slug}'s entry hostnames straight to their containers`,
             destroys: false,
             migrates: false,
         },